cvesecurityvulnerability
CVE-2026-16974: Kirki WordPress Plugin Stored XSS in 500,000+ Sites
The Kirki page builder plugin for WordPress, active on over 500,000 sites, contains a stored cross-site scripting vulnerability in its post_meta shortcode. Authenticated users with Contributor access can inject malicious JavaScript into pages. Fixed in version 6.2.1.
